Johannes/java-commons
Johannes
/
java-commons
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(serialize-json): prevent json injection via malicious comments

This commit is contained in:
Johannes Frohnmeyer 2024-04-20 14:30:39 +02:00
parent 615ff12c27
commit 7bcde68b9f
Signed by: Johannes
GPG Key ID: E76429612C2929F4
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
commons-serialize-json/src/main/java/io/gitlab/jfronny/commons/serialize/json/JsonWriter.java
View File

@ -182,7 +182,10 @@ public class JsonWriter extends SerializeWriter<IOException, JsonWriter> impleme
private void writeDeferredComment() throws IOException {
if (!deferredComments.isEmpty()) {
if (newline.isEmpty()) {
out.append("/* ").append(String.join(" / ", deferredComments)).append(" */");
out.append("/* ")
.append(String.join(" / ", deferredComments)
.replace("*/", "#/"))
.append(" */");
} else {
boolean first = true;
for (String s : deferredComments) {